Sharing of firewall rules among multiple workloads in a hypervisor

A non-transitory computer-readable storage medium containing instructions, that when executed, control a computer system to be operable for:

• receiving a packet at an instance of a distributed firewall associated with one of a plurality of workloads running on a hypervisor, wherein each of the plurality of workloads has an associated instance of the distributed firewall;
• accessing an index table for the workload, wherein the index table includes a set of references to a set of rules in a rules table, wherein the set of rules stores a single instance of at least one rule and each workload in the plurality of workloads is associated with an index table that references rules that are applicable to each respective workload;
• accessing the at least one rule in the set of rules associated with the set of references from the rules table;
• and
• comparing one or more attributes for the packet to information stored for the at least one rule in the set of rules to determine a rule in the set of rules to apply to the packet, wherein:
• a first index for a first workload in the plurality of workloads references a first set of rules, and
• a second index for a second workload in the plurality of workloads references a second set of rules, wherein at least one rule in the first set of rules and the second set of rules is the same.

An apparatus comprising:

• one or more computer processors;
• and
• a non-transitory computer-readable storage medium comprising instructions, that when executed, control the one or more computer processors to be operable for:
• receiving a packet at an instance of a distributed firewall associated with one of a plurality of workloads running on a hypervisor, wherein each of the plurality of workloads has an associated instance of the distributed firewall;
• accessing an index table for the workload, wherein the index table includes a set of references to a set of rules in a rules table, wherein the set of rules stores a single instance of at least one rule and each workload in the plurality of workloads is associated with an index table that references rules that are applicable to each respective workload;
• accessing the at least one rule in the set of rules associated with the set of references from the rules table;
• and
• comparing one or more attributes for the packet to information stored for the at least one rule in the set of rules to determine a rule in the set of rules to apply to the packet, wherein:
• a first index for a first workload in the plurality of workloads references a first set of rules, and
• a second index for a second workload in the plurality of workloads references a second set of rules, wherein at least one rule in the first set of rules and the second set of rules is the same.